Refinement-based context-sensitive points-to analysis for Java

Developing scalable and precise points-to analyses is increasingly important for analysing and optimising object-oriented programs where pointers are used pervasively. An incremental analysis for a program updates the existing analysis information after program changes to avoid reanalysing it from scratch. This can be efficiently deployed in software development environments where code changes are often small and frequent. This paper presents an incremental approach for demand-driven context-sensitive points-to analyses based on Context-Free Language (CFL) reachability. By tracing the CFL-reachable paths traversed in computing points-to sets, we can precisely identify and recompute on demand only the points-to sets affected by the program changes made. Combined with a flexible policy for controlling the granularity of traces, our analysis achieves significant speedups with little space overhead over reanalysis from scratch when evaluated with a null dereferencing client using 14 Java benchmarks.

Dynamic languages such as Python allow programs to be written more easily using high-level constructs such as comprehensions for queries and using generic code. Efficient execution of programs then requires powerful optimizations - incrementalization of expensive queries and specialization of generic code. Effective incrementalization and specialization of dynamic languages require precise and scalable alias analysis. This paper describes the development and experimental evaluation of a may-alias analysis for a full dynamic object-oriented language, for program optimization by incrementalization and specialization. The analysis is flow-sensitive; we show that this is necessary for effective optimization of dynamic languages. It uses precise type analysis and a powerful form of context sensitivity, called trace sensitivity, to further improve analysis precision. It uses a compressed representation to significantly reduce the memory used by flow-sensitive analyses.We evaluate the effectiveness of this analysis and 17 variants of it for incrementalization and specialization of Python programs, and we evaluate the precision, memory usage, and running time of these analyses on programs of diverse sizes. The results show that our analysis has acceptable precision and efficiency and represents the best trade-off between them compared to the variants.

Context-sensitive points-to analysis is valuable for achieving high precision with good performance. The standard flavors of context-sensitivity are call-site-sensitivity (kCFA) and object-sensitivity. Combining both flavors of context-sensitivity increases precision but at an infeasibly high cost. We show that a selective combination of call-site- and object-sensitivity for Java points-to analysis is highly profitable. Namely, by keeping a combined context only when analyzing selected language features, we can closely approximate the precision of an analysis that keeps both contexts at all times. In terms of speed, the selective combination of both kinds of context not only vastly outperforms non-selective combinations but is also faster than a mere object-sensitive analysis. This result holds for a large array of analyses (e.g., 1-object-sensitive, 2-object-sensitive with a context-sensitive heap, type-sensitive) establishing a new set of performance/precision sweet spots.

Context-sensitive points-to analysis is the current most scalable technology for constructing a precise control-flow graph for large object-oriented programs. One appealing feature of this framework is that it is parametric thus allowing to trade time for precision. Typical instances of this framework are κ-CFAs and Agesen's Cartesian Product Algorithm (CPA). It is common sense that κ-CFAs (for increasing κs) form a hierarchy. Yet, what is the relative precision of κ-CFA and CPA? Grove and Chambers [2] conjecture that CPA is more precise than ∞-CFA. For a core object-oriented language, we formally compare the precision of ∞-CFA and CPA. We prove that CPA is indeed strictly more precise than ∞-CFA. On a theoretical level, this result confirms the findings of empiric studies concluding the superiority of object-sensitivity with respect to call-string sensitivity.

Analysis, calculation and utilization of the k-balance attribute in interdependent networks

Several advantages of the present study in comparison with previous related work are based upon the richness of the data used. The detail and relative completeness of the data permit a more precise analysis with more meaningful conclusions than has previously been possible.

An advanced high speed solder ball impact tester (BIT) was developed together with its operation system based on the industrial demand of solder joint reliability tests. Different from the previous approaches, by applying some novel mechanical and software designs, this unique BIT system is able to perform precise high speed solder ball impact tests and automatic data analysis to fulfill the users' requirements. In this work, the methods that this BIT system used to overcome existing problems in former BIT designs are introduced. The performance of the BIT has been evaluated in the impact tests on SAC105 and SAC305 solder joints. By utilizing this BIT, ram height changes without violating the JEDEC's standards is proved to be trivial for SAC305 solder joint under high speed impact.

Event-driven systems maintain an ongoing dialog with their environment. Examples include: distributed programs, where each process reacts to received messages by performing computation and sending messages to peers; graphical user interfaces (GUI), where the interface software and the underlying application react to user inputs and web-based applications, where presentation, business logic and storage tier functionality react to user inputs and response from other web-based services. Such applications are difficult to test because the set of possible interaction sequences between the system and its environment can be very large and governed by complex constraints. The exhaustive nature of software model checking techniques offers hope for effectively validating such systems, however, they only work for closed systems. Previously, the authors developed the Bandera Environment Generator, which given an open system, called a unit under analysis, closes it with a model of its environment. The authors' previous work on environment generation has focused on developing broadly applicable mechanisms for modelling environment behaviour. The generality of this approach often makes it difficult to produce environment models that enable precise and efficient system analysis. The authors' experience shows that by exploiting information about the application domain, generated environments can be made both more precise and more efficient for model checking. This study presents the concept of domain-specific environment generation, details techniques for customising environment generation for the domain of event-driven software, and assesses those techniques on the domains of GUI and web-based applications.

The consideration of micro ribonucleic acid (microRNA) molecules is justified by their ability to act as possible biomarkers, which may be used to detect the most prevalent type of lung cancer: non-small-cell lung cancer (NSCLC). This article describes a surface plasmon resonance imaging (SPRi) biosensor, which was considered to detect malignant lung cells using an Au/Ag heterostructure, as well as the DNA tetrahedron framework (DNATF). Considering the Au/Ag heterostructure and the DNATF, the proposed SPRi biosensor was evaluated. Thus, its detection range belongs to the interval 1.82 fM up to 28 nM. The measured limit of detection of this biosensor is 1.55 fM, and the generated images offer sufficient fidelity to conduct a precise medical analysis. Therefore, patients who suffer from NSCLC may be accurately and efficiently determined. The experimental evaluation, which is presented, suggests that this is a biosensor that is capable of optimizing the clinical detection of NSCLC.

The performance of a supercomputer built with commodity components

This paper presents F4F (Framework For Frameworks), a system for effective taint analysis of framework-based web applications. Most modern web applications utilize one or more web frameworks, which provide useful abstractions for common functionality. Due to extensive use of reflective language constructs in framework implementations, existing static taint analyses are often ineffective when applied to framework-based applications. While previous work has included ad hoc support for certain framework constructs, adding support for a large number of frameworks in this manner does not scale from an engineering standpoint. F4F employs an initial analysis pass in which both application code and configuration files are processed to generate a specification of framework-related behaviors. A taint analysis engine can leverage these specifications to perform a much deeper, more precise analysis of framework-based applications. Our specification language has only a small number of simple but powerful constructs, easing analysis engine integration. With this architecture, new frameworks can be handled with no changes to the core analysis engine, yielding significant engineering benefits. We implemented specification generators for several web frameworks and added F4F support to a state-of-the-art taint-analysis engine. In an experimental evaluation, the taint analysis enhanced with F4F discovered 525 new issues across nine benchmarks, a harmonic mean of 2.10X more issues per benchmark. Furthermore, manual inspection of a subset of the new issues showed that many were exploitable or reflected bad security practice.

The ability to summarize procedures is fundamental to building scalable interprocedural analyses. For sequential programs, procedure summarization is well-understood and used routinely in a variety of compiler optimizations and software defect-detection tools. However, the benefit of summarization is not available to multithreaded programs, for which a clear notion of summaries has so far remained unarticulated in the research literature.In this paper, we present an intuitive and novel notion of procedure summaries for multithreaded programs. We also present a model checking algorithm for these programs that uses procedure summarization as an essential component. Our algorithm can also be viewed as a precise interprocedural dataflow analysis for multithreaded programs. Our method for procedure summarization is based on the insight that in well-synchronized programs, any computation of a thread can be viewed as a sequence of transactions, each of which appears to execute atomically to other threads. We summarize within each transaction; the summary of a procedure comprises the summaries of all transactions within the procedure. We leverage the theory of reduction [17] to infer boundaries of these transactions.The procedure summaries computed by our algorithm allow reuse of analysis results across different call sites in a multithreaded program, a benefit that has hitherto been available only to sequential programs. Although our algorithm is not guaranteed to terminate on multithreaded programs that use recursion (reachability analysis for multithreaded programs with recursive procedures is undecidable [18]), there is a large class of programs for which our algorithm does terminate. We give a formal characterization of this class, which includes programs that use shared variables, synchronization, and recursion.

This study presents a MATLAB-based approach to automate subroutine generation for ABAQUS ground stress simulations, significantly reducing the manual effort and potential for error in complex engineering projects.The automated tool achieves high accuracy and consistency in stress calculations, verified through a case study involving underground tunnel simulations.Results demonstrate that the tool not only accelerates simulation preparation by over 80% but also enhances reliability by maintaining an error rate below 1%.These outcomes underscore the tool's practical value in improving simulation workflows, making it a viable solution for engineers seeking efficient, precise, and scalable ground stress analysis methods.

Hard real-time systems require absolute guarantees in their execution times. Worst case execution time (WCET) of a program has therefore become an important problem to address. However, performance enhancing features of a processor (e.g. cache) make WCET analysis a difficult problem. In this paper, we propose a novel analysis framework by combining abstract interpretation and program verification for different varieties of cache analysis ranging from single to multi-core platforms. Our framework can be instantiated with different program verification techniques, such as model checking and symbolic execution. Our modeling is used to develop a precise yet scalable timing analysis method on top of the Chronos WCET analysis tool. Experimental results demonstrate that we can obtain significant improvement in precision with reasonable analysis time overhead.

The numbers and sizes of JavaScript applications are ever growing but static analysis techniques for analyzing large-scale JavaScript applications are not yet ready in a scalable and precise manner. Even when building complex software like compilers and operating systems in JavaScript, developers do not get much benefits from existing static analyzers, which suffer from mutually intermingled problems of scalability and imprecision. In this paper, we present Loop-Sensitive Analysis (LSA) that improves the analysis scalability by enhancing the analysis precision in loops. LSA distinguishes loop iterations as many as needed by automatically choosing loop unrolling numbers during analysis. We formalize LSA in the abstract interpretation framework and prove its soundness and precision theorems using Coq. We evaluate our implementation of LSA using the analysis results of main web pages in the 5 most popular websites and those of the programs that use top 5 JavaScript libraries, and show that it outperforms the state-of-the-art JavaScript static analyzers in terms of analysis scalability. Our mechanization and implementation of LSA are both publicly available.